WSE and X509 trouble

From: andrea (a.canade_at_retis.it)
Date: 10/15/04 

Date: 15 Oct 2004 01:44:31 -0700

Hi all

i've some question about security with x509 that are not clear to me
:(

are these steps correct to make a security soap based test
application?

terminology:
client is a console application that send signed soap request and
receive signed soap response or faults...

server is a web service using policy files to add security requirement
to the project.

SERVER

1) i create a webservice (stupid: only a string Repeat(string word)
web-method)
i configure the solution with WSE, particularry i set on security tab
LocalMachine as store location
and policy files with a default endpoint...

at this point the wizard start... i chose to make a secure server
i check use signed request
i check use signed response then next...

i choose X509 certificate

now wizard tell me to choose the certificate to use for client
authentication?'
what does this mean ??
is the certificate inserted on the soap request by client?... i mean
so..
i insert anything and choose next and complete the wizard

now i build and my service is up !!

CLIENT
2) soap communication with digiatal certificate mean that the client
buy a certifcate from (i said one) "verisign" for example...
it is correct?

the client put the certificate in his Store CurrentUser store
but what is the location? Trusted? People?

2)
I create a client application
i add a proxy created with wsdl.exe
i change the base class of the proxy to make it work with WSE

i enable WSE for my application

NOW must i Add the policy file created on server side?
or must i create a new policy file for client security??

i've created a new policy file
but the wizard
- tell me to add a certificate site in the current-user personal store
(but the certificate must not be inserted into the Thrusted store? )
- tell me to choose another certificate to authenticate the service
what does this mean? i've only one certificate

thank you for patience
andrea

Relevant Pages

  • Re: Web Service Security
    ... The asmx file security is now set to 'ignore client certificates.' ... Viewing the certificate using the View Certificate button under directory ... you must install the certificate with a private key (usually ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: (New Subject): How to eliminate prompt for credentials when using RPC over HTTP
    ... > that it is installed on the client running Outlook 2003. ... > *Certificate Configuration* ... > Security Alert pops up regarding the certificate. ...
    (microsoft.public.windows.server.sbs)
  • WSE -3.0 WebServices Deployement in IIS Server
    ... I have developed Web services based on WSE3.0 X.509 Certificate ... services and client application working fine with out any issues. ... I am getting following error message, I think some security settings ...
    (microsoft.public.dotnet.framework.webservices)
  • WSE -3.0 Deployement in IIS Server Issues
    ... I have developed Web services based on WSE3.0 X.509 Certificate ... services and client application working fine with out any issues. ... I am getting following error message, I think some security settings ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Using Policy with WSE2.0 (From WSE Drilldown examples)
    ... I have added the "Root Agency" certificate to "Trusted Root ... Under Security Tab, ticked "Allow test roots" and select ... Under policy, ... > Conversation: SOAP Message from WSE ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
Loading